[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 1 require for Maintenance?

[Assistant]
According to Workshop Summary Report for “Workshop on Foundational Cybersecurity Activities for IoT Device Manufacturers”:

Additional information about this publication is available at https://csrc.nist.gov/pubs/ir/8572/final, including related content, potential updates, and document history.

This report summarizes discussions held at the March 5, 2025 "Workshop on Foundational Cybersecurity Activities for IoT Device Manufacturers' organized by the NIST Cybersecurity for the Internet of Things (IoT) program. This workshop follows an earlier event held in December 2024 titled 'Workshop on Updating Manufacturer Guidance for Securable Connected Product Development' to identify major update areas to NIST IR 8259. Similarly, the purpose of this more recent workshop was to discuss planned updates to NIST IR 8259 and gather additional feedback on taking a product viewpoint with greater emphasis on the IoT product lifecycle, expanded discussion of risk analysis, application to industrial contexts, and cybersecurity considerations around data management to support privacy goals. Over time, NIST work has built upon the concepts introduced in the NIST IR 8259, as reflected in subsequent publications that elaborate on IoT cybersecurity for specific sectors and use cases (e.g., federal agency use of IoT, consumer use of IoT in the home or in small businesses).

On March 5, 2025, NIST's Cybersecurity for Internet of Things (IoT) program hosted 'Workshop on Foundational Cybersecurity Activities for IoT Device Manufacturers' to continue discussion of potential updates to Foundational Cybersecurity Activities for IoT Device Manufacturers, NIST IR 8259 [1]. The March workshop follows the December 4 th , 2024, workshop titled 'Workshop on Updating Manufacturer Guidance for Securable Connected Product Development' which first explored potential updates to NIST IR 8259.

Workshop Summary Report for “Workshop on Foundational Cybersecurity Activities for IoT Device Manufacturers”


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 1 require for Physical Protection?

[Assistant]
According to Foundational Cybersecurity Activities for IoT Device Manufacturers:

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. Manufacturers are creating an incredible variety and volume of internet-ready devices broadly known as the Internet of Things (IoT). Many of these IoT devices do not fit the standard definitions of information technology (IT) devices that have been used as the basis for defining device cybersecurity capabilities (e.g., smartphones, servers, laptops). The IoT devices in scope for this publication have at least one transducer (sensor or actuator) for interacting directly with the physical world and at least one network interface (e.g., Ethernet, Wi-Fi, Bluetooth, LongTerm Evolution [LTE], Zigbee, Ultra-Wideband [UWB]) for interfacing with the digital world. The IoT devices in scope for this publication can function on their own, although they may be dependent on specific other devices (e.g., an IoT hub) or systems (e.g., a cloud) for some functionality. Many IoT devices have computing functionality, data storage, and network connectivity along with functionality associated with equipment that previously lacked these computing functions (e.g., smart appliances). In turn, these functions enable new efficiencies and technological capabilities for the equipment, such as remote access for monitoring, configuration, and troubleshooting.

Foundational Cybersecurity Activities for IoT Device Manufacturers


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Supply Chain Risk Management?

[Assistant]
According to Assessing Security and Privacy Controls in Information Systems and Organizations:

NTROL ASSESSMENTS ..................................................... 30
3.4   ANALYZE ASSESSMENT REPORT RESULTS .....................................................................................
32
3.5   ASSESS SECURITY AND PRIVACY CAPABILITIES .............................................................................. 34
CHAPTER FOUR SECURITY AND PRIVACY ASSESSMENT PROCEDURES ................................................. 37
4.1   ACCESS CONTROL............................................................................................................................ 40
4.2   AWARENESS AND TRAINING ........................................................................................................ 118
4.3   AUDIT AND ACCOUNTABILITY ...................................................................................................... 128
4.4   ASSESSMENT, AUTHORIZATION, AND MONITORING ................................................................. 160
4.5   CONFIGURATION MANAGEMENT ................................................................................................ 177
4.6   CONTINGENCY PLANNING ............................................................................................................ 215
4.7   IDENTIFICATION AND AUTHENTICATION .................................................................................... 243
4.8   INCIDENT RESPONSE ............................................................................................................... 275
4.9   MAINTENANCE ........................................................................................................................ 298
4.10   MEDIA PROTECTION .............................................................................................................. 316
4.11   PHYSICAL AND ENVIRONMENTAL PROTECTION .......................................................................

Assessing Security and Privacy Controls in Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AU.L2-3.3.3 (NIST 3.3.3)?

[Assistant]
According to Digital Identity Guidelines_ Federation and Assertions:

3.3.3. 3.3.3. 3.3.3), the upstream IdP may not be able to generate a PPI for the downstream RP, since the proxy could blind the IdP from knowing which RP is being accessed by the subscriber.

Digital Identity Guidelines_ Federation and Assertions


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Guide to SSL VPNs:

includes the process of working with a help desk to provide assistance for end users. 5. Manage the Solution. After the SSL VPN solution has been deployed, it must be managed throughout its lifecycle.
Management includes maintenance (e.g., patching, solution expansion, key management, policy changes), performance monitoring, and periodic testing/validation of the solution. The handling of operational issues must also be considered.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to Information and Communications Technology (ICT) Risk Outcomes_ Integrating ICT Risk Management Programs with the Enterprise Risk Portfolio:

Milestones (POA&M) document. A private-sector organization determines that a risk will require funding from next fiscal year to fully address and records the corresponding risk plan in a project plan.
|
|                                                                                | MA.RR-6 : Risk analysis is revised after risk responses are determined to reflect the envisioned reduction of likelihood and impact from each risk response. | An organization updates the Current Assessment - Likelihood, Impact, and Exposure Rating fields of a risk register after the risk responses have been documented. |
|                                                                                | MA.RR-7: Controls are implemented or adjusted to perform risk response plans. | An organization implements security controls to enact a risk response, and those actions are recorded in the Risk Response Description field of a risk register. |
|                                                                                | MA.RR-8 : Residual risk is forecasted for each risk after risk responses are decided. | An organization estimates its residual risk and records it in the Residual Risk field of a risk register. |
| Risk Monitoring, Evaluation, and Adjustment (MA.RM): Risks are checked and assessed, and risk responses are adapted as needed. | MA.RM-1 : Risk conditions are continually monitored against risk tolerance to ensure conditions remain within acceptable levels. | Risks are measured and benchmarked according to key performance indicators (KPIs) and key risk indicators (KRIs), respectively. |
| Risk Monitoring, Evaluation, and Adjustment (MA.RM): Risks are checked and assessed, and risk responses are adapted as needed.

Information and Communications Technology (ICT) Risk Outcomes_ Integrating ICT Risk Management Programs with the Enterprise Risk Portfolio


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Report of the Virtual Workshop on Usable Cybersecurity and Privacy for Immersive Technologies:

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems.

combination of user behavioral and physical data. Also, virtual environments require significant amounts of data and similarly significant technological protections for data (e.g., encryption, local or on-device processing). This can present costs and trade-offs (e.g., privacy and security vs. safety).

Specific to privacy, the following key considerations for immersive technologies were highlighted through discussions. Participants noted that there could be tensions between data minimization requirements and the amount and variety of data needed to power immersive technologies. Also, principles such as consent, user control, and autonomy may be difficult to uphold for involuntary and unconscious or subconscious behaviors or physical acts.

Report of the Virtual Workshop on Usable Cybersecurity and Privacy for Immersive Technologies


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Automation Support for Security Control Assessments_ Volume 1_ Overview:

tion of Volume 1.......................................................................................................3                                                                          |
| 2.
Overview of an Automated Security Control Assessment Process .......................................4                                                                                |
| 2.1 Prerequisites to Automated Security Control Assessment......................................................4                                                                                |
| 2.2 Automating the Test Assessment Method................................................................................5                                                                                |
| 2.2.1 Terms for Referring to Assessment Objects......................................................................6                                                                                |
| 2.3 Factors for Determining When to Trust Automated Ongoing Assessments ...........................6                                                                                |
| 2.4 An Automated Security Control Assessment Program: ISCM................................................7                                                                                |
| 2.5 Preparing for Automated Security Control Assessments........................................................9                                                                                |
| 3.

Automation Support for Security Control Assessments_ Volume 1_ Overview


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Planning?

[Assistant]
According to Computer Security Division 2008 Annual Report:

During  FY2008  CSD  explored  opportunities  to  apply  its  security  research to  national  priorities  and  internal  NIST  initiatives. The  CSD  has  played  an active  role  in  implementation  planning  for  the  Comprehensive  National Cyber Security Initiative to protect our country's critical infrastructure. The CSD continued to expand its support for two key national initiatives, electronic voting and health information technology, by researching the security requirements of those areas and applying the results of that research, along with current technologies, to advance the stated goals of those initiatives. CSD also worked closely with the ITL management team to integrate security projects into ITL's research programs. These programs, which include Cyber Security,  Pervasive  Information  Technologies,  Identity  Management,  and Trustworthy Software, are designed to organize and build ITL core competencies in the most efficient manner, and to maximize the use of ITL resources to address emerging information technology challenges. This revision of SP 800-60 further clarifies the system security categorization process; discusses the impact of security categorization results on other enterprise-wide activities such as capital planning, enterprise architecture, and disaster recovery planning; and provides recommendations and rationale for mission-based and management and support information types. The  requirement  to  measure  information  security  performance  is  driven by regulatory, financial, and organizational reasons. A number of existing laws, rules, and regulations, such as the Clinger-Cohen Act, the Government Performance and Results Act (GPRA), and the Federal Information Security Management Act  (FISMA),  cite  information  performance  measurement  in general  and  information  security  measurement  in  particular  as  a  requirement.

Computer Security Division 2008 Annual Report


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Incident Response?

[Assistant]
According to Guide to a Secure Enterprise Network Landscape:

- Packet filters and network address translation: Packet filtering and Network address translation (NAT) are used to monitor and control packets moving across a network interface, apply predetermined security rules, and obscure the internal network from the public internet. - Stateful inspection: Stateful firewalling, also known as dynamic packet filtering, monitors the state of connections and makes determinations as to what types of data packets belong to a known active connection and can be allowed to pass through the firewall. - Deep packet inspection (DPI): This feature, also known as packet sniffing, examines the content of packets (both the header and the payload, unlike the stateful inspection that inspects only the packet header). In addition to the capability provided by stateful inspection, this has capabilities related to finding hidden threats within the data stream, such as attempts at data exfiltration, violations of content policies, malware, and more. - Threat detection and response: Modern firewalls can gather and analyze enough data across multiple packets and sessions to detect threats and security incidents targeted at a particular system or a family of systems. These data from multiple firewalls can also be directed toward security information and event management (SIEM) and correlated with data from other security tools and IT systems to detect enterprise-wide attacks that span multiple systems and network layers. In addition, these data can be used to understand evolving threats and define new access rules, attack patterns, and defensive strategies [6]. - Logging and auditing capabilities: Logging and auditing capabilities result in the construction of network events that can be used to identify patterns of performance and security issues. - Access control functions: Access control functions enforce granular sophisticated access control policies.

Guide to a Secure Enterprise Network Landscape


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Ransomware Risk Management_ A Cybersecurity Framework Profile:

| Category | Subcategory and Selected Informative References | Ransomware Application | |-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Identify | | | | Asset Management (ID.AM): The data, personnel, devices, systems, and facilities that enable the organization to achieve business purposes are identified and managed consistent with their relative importance to organizational objectives and the organization's risk strategy.

Ransomware Risk Management_ A Cybersecurity Framework Profile


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Foundations of a Security Policy for Use of the National Research and Educational Network:

The National Research and Education Network is one part of a Federal program establishing a comprehensive set of computing and communications services throughout the nation's scientific and educational communities. It consists of a large number of Federal, State and commercial entities providing and using a wide range of services. As such, it will be organized as a cooperative with a membership including service suppliers and users with a distributed management structure. Basic security services will be expected by most users with special security services required by others.

Foundations of a Security Policy for Use of the National Research and Educational Network


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Media Protection?

[Assistant]
According to Cybersecurity Framework Profile for Hybrid Satellite Networks (HSN):

| Subcategory                                                                                | Applicability to HSNs                                                                                | Informative References                                                                                |
|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| PR.IP-1: A baseline configuration of information technology/industrial control systems is created, maintained, and incorporates security principles (e.g., concept of least functionality). | Focus on the configuration and maintenance of the entities at the interface to the HSN. Baseline and configuration are internal concerns, and obtaining detailed configuration information from the partners is not practical. | NIST SP 800-53 Rev. 5 CM-1, CM-2, CM-3, CM-4, CM-5, CM-6, CM-7, CM-9, SA-10 NIST SP 800-137 Section D NIST SP 800-160V1 3.4.9, 3.4.10, 3.4.11, Appendix F, Appendix G |
| PR.IP-2: ASystem Development Life Cycle (SDLC) to manage systems is implemented.

Cybersecurity Framework Profile for Hybrid Satellite Networks (HSN)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to 1989 Computer Security and Privacy Plans (CSPP) Review Project_ A First-Year Federal Response to the Computer Security Act of 1987 (Final Report):

Agent i on also should fully document in-place controls to ease | >< * i iodic reevaluation, internal audit, and oversight agency rev i ew | | | | | | | | | | | PAGE | | | | | | | | | | | |-----------------------------------------------------------|------------------------------------------|------------------------------------------|------------------------------------------|------------------------------------------|------------------------------------------|------------------------------------------|------------------------------------------|------------------------------------------|------------------------------------------|--------|------------------------------------------|------------------------------------------|------------------------------------------|------------------------------------------|------------------------------------------|------------------------------------------|------------------------------------------|------------------------------------------|------------------------------------------|------------------------------------------| | ABSTRACT | | | | | | | | | | iii | | | | | | | | | | | | LETTER | FROM | JAMES H.

1989 Computer Security and Privacy Plans (CSPP) Review Project_ A First-Year Federal Response to the Computer Security Act of 1987 (Final Report)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AC.L2-3.1.7 (NIST 3.1.7)?

[Assistant]
According to Interfaces for Personal Identity Verification_ Part 1 – PIV Card Application Namespace, Data Model and Representation:

3.1.7.

Interfaces for Personal Identity Verification_ Part 1 – PIV Card Application Namespace, Data Model and Representation


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.3 (NIST 3.2.3)?

[Assistant]
According to Cryptographic Algorithms and Key Sizes for Personal Identity Verification:

3.2.3. 3.2.3. 3.2.3.

Cryptographic Algorithms and Key Sizes for Personal Identity Verification


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to The NIST Cybersecurity Framework (CSF) 2.0:

CSF Tiers | Function | Category | Category Identifier | |---------------|---------------------------------------------------------|-----------------------| | Govern (GV) | Organizational Context | GV.OC | | Govern (GV) | Risk Management Strategy | GV.RM | | Govern (GV) | Roles, Responsibilities, and Authorities | GV.RR | | Govern (GV) | Policy | GV.PO | | Govern (GV) | Oversight | GV.OV | | Govern (GV) | Cybersecurity Supply Chain Risk Management | GV.SC | | Identify (ID) | Asset Management | ID.AM | | Identify (ID) | Risk Assessment | ID.RA | | Identify (ID) | Improvement | ID.IM | | Protect (PR) | Identity Management, Authentication, and Access Control | PR.AA | | Protect (PR) | Awareness and Training | PR.AT | | Protect (PR) | Data Security | PR.DS | | Protect (PR) | Platform Security | PR.PS | | Protect (PR) | Technology Infrastructure Resilience | PR.IR | | Detect (DE) | Continuous Monitoring | DE.CM | | Detect (DE) | Adverse Event Analysis | DE.AE | | Respond (RS) | Incident Management | RS.MA | | Respond (RS) | Incident Analysis | RS.AN | | Respond (RS) | Incident Response Reporting and Communication | RS.CO | | Respond (RS) | Incident

The NIST Cybersecurity Framework (CSF) 2.0


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Guidelines on Firewalls and Firewall Policy:

| Executive Summary..............................................................................................................ES-1   | Executive Summary..............................................................................................................ES-1    | Executive Summary..............................................................................................................ES-1    | Executive Summary..............................................................................................................ES-1    |
|---------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------|
| 1.

Guidelines on Firewalls and Firewall Policy


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does PIV Card to Reader Interoperability Guidelines provide? (Part 5)

[Assistant]
3                                | PIV Contact Card Reader (Physical Access).............................................................. 3                                |
|               | 2.2.1                                                                                | Common Requirements ..................................................................................3                                  |
| 2.3           | PIV Contactless Card Reader (Logical Access).......................................................... 3                                 | PIV Contactless Card Reader (Logical Access)..........................................................

PIV Card to Reader Interoperability Guidelines

Planning
System and Services Acquisition
Physical Protection
Awareness and Training
Incident Response
Configuration Management
Maintenance
Security Assessment
System and Communications Protection
Media Protection
Risk Assessment
Audit and Accountability
Personnel Security
Identification and Authentication
Access Control
System and Information Integrity


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Using Business Impact Analysis to Inform Risk Prioritization and Response:

ts and stores the results in the BIA Register. An asset criticality or resource dependency assessment identifies and prioritizes the information assets that support the enterprise's critical missions.
Similarly, assessments of asset sensitivity identify and prioritize information assets that store, process, or transmit information that must not be modified or disclosed to unauthorized parties. In the cybersecurity realm, the use of the BIA has historically been limited to calculations of quality-based and time-based objectives for incident handling (including continuity of operations and disaster recovery). Because the BIA serves as a nexus for understanding risk (which is the measurement of uncertainty on the mission), it provides a basis for risk appetite and tolerance values as part of the enterprise risk strategy. 1 That guidance supports performance and risk metrics based on the relative value of enterprise assets to communicate and monitor Cybersecurity Risk Management 2  (CSRM) activities, including measures determined to be key performance indicators (KPIs) and key risk indicators (KRIs). The BIA supports asset classification that drives requirements, risk communications, and monitoring. Expanding use of the BIA to include confidentiality and integrity considerations supports comprehensive risk analysis. The basis of asset valuation on enterprise impact helps to better align risk decisions to enterprise risk strategy. CSRM/ERM integration helps to complete the risk

Using Business Impact Analysis to Inform Risk Prioritization and Response


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 1 require for Physical Protection?

[Assistant]
According to Fiscal Year 2022 Cybersecurity and Privacy Annual Report:

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. The Special Publication 800-series reports on ITL's research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations.

Fiscal Year 2022 Cybersecurity and Privacy Annual Report


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Non-Fungible Token Security provide? (Part 2)

[Assistant]
aft publications during public comment periods and provide feedback to NIST. Many NIST cybersecurity publications, other than the ones noted above, are available at https://csrc.nist.gov/publications.
## NIST Technical Series Policies

Copyright, Use, and Licensing Statements

NIST Technical Series Publication Identifier Syntax

## Publication History

Approved by the NIST Editorial Review Board on 2024-02-02

## How to Cite this NIST Technical Series Publication:

Mell P, Yaga D (2024) Non-Fungible Token Security. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Interagency or Internal Report (IR) NIST IR 8472. https://doi.org/10.6028/NIST.IR.8472

## Author ORCID iDs

Peter Mell: 0000-0003-2938-897X

Dylan Yaga: 0000-0003-4058-3645

## Contact Information

NISTIR8472@nist.gov

National Institute of Standards and Technology Attn: Computer Security Division, Information Technology Laboratory 100 Bureau Drive (Mail Stop 8930) Gaithersburg, MD 20899-8930

## Additional Information

Additional information about this publication is available at https://csrc.nist.gov/pubs/ir/8472/final, including related content, potential updates, and document history. All comments are subject to release under the Freedom of Information Act (FOIA). ## Abstract

Non-fungible token (NFT) technology provides a mechanism to enable real assets (both virtual and physical) to be sold and exchanged on a blockchain. While NFTs are most often used for autographing digital assets (associating one's name with a digital object), they utilize a strong cryptographic foundation that may enable them to regularly support ownership-transferring sales of digital and physical objects. For this, NFT implementations need to address potential security concerns to reduce the risk to purchasers. This publication explains NFT technology and then identifies and discusses a list of 27 potential security issues.

Planning
System and Services Acquisition
Physical Protection
Awareness and Training
Incident Response
Supply Chain Risk Management
Configuration Management
Maintenance
Security Assessment
System and Communications Protection
Media Protection
Risk Assessment
Audit and Accountability
Personnel Security
Identification and Authentication
Access Control
System and Information Integrity


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What are the CMMC Level 1 requirements?

[Assistant]
According to Security Segmentation in a Small Manufacturing Environment:

<!-- image -->

## NIST Cybersecurity White Paper NIST CSWP 28

## Security Segmentation in a Small Manufacturing Environment

Dr. Michael Powell National Cybersecurity Center of Excellence National Institute of Standards and Technology

John Hoyt Aslam Sherule Dr. Lynette Wilcox The MITRE Corporation

This publication is available free of charge from:

https://doi.org/10.6028/NIST.CSWP.28

April 6 , 2023

<!-- image -->

Certain commercial entities, equipment, or materials may be identified in this document in order to describe an experimental procedure or concept adequately. Such identification is not intended to imply recommendation or endorsement by the National Institute of Standards and Technology (NIST), nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose. ## NIST Technical Series Policies

Copyright, Fair Use, and Licensing Statements NIST Technical Series Publication Identifier Syntax

## Publication History

Approved by the NIST Editorial Review Board on 2023-03-3 0

## How to Cite this NIST Technical Series Publication:

Powell M, Hoyt J, Sherule A, Wilcox L (202 3 ) Security Segmentation in a Small Manufacturing Environment. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Cybersecurity White Paper (CSWP) NIST CSWP 28. https://doi.org/10.6028/NIST.CSWP.28

## Author ORCID iDs

Dr. Michael Powell: 0000-0002-3922-7435 John Hoyt: 0000-0002-0783-7036 Aslam Sherule: 0000-0002-2003-3817 Dr. Lynette Wilcox: 0000-0003-1246-6505

## Contact Information

manufacturing\_nccoe@nist.gov

National Institute of Standards and Technology Attn: Applied Cybersecurity Division, Information Technology Laboratory 100 Bureau Drive (Mail Stop 2000) Gaithersburg, MD 20899-2000

All comments are subject to release under the Freedom of Information Act (FOIA). ## Abstract

Manufacturers are increasingly targeted in cyber-attacks.

Security Segmentation in a Small Manufacturing Environment


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does NIST provide for CMMC Level 3?

[Assistant]
According to Security Requirements for Cryptographic Modules:

## FIPS PUB 140-3

## FEDERAL INFORMATION PROCESSING STANDARDS PUBLICATION

(Supersedes FIPS PUB 140-2)

## SECURITY REQUIREMENTS FOR CRYPTOGRAPHIC MODULES

CATEGORY: INFORMATION SECURITY     SUBCATEGORY: CRYPTOGRAPHY

Information Technology Laboratory National Institute of Standards and Technology Gaithersburg, MD  20899-8900

This publication is available free of charge from: https://doi.org/10.6028/NIST.FIPS.140-3

March 22, 2019

<!-- image -->

## U.S. Department of Commerce

Wilbur L. Ross, Jr., Secretary

National Institute of Standards and Technology

Walter Copan, NIST Director and Under Secretary for Standards and Technology

## FOREWORD

The  Federal  Information  Processing  Standards  Publication  Series  of  the  National  Institute  of Standards and Technology (NIST) is the official series of publications relating to Standards and Guidelines adopted and promulgated under the provisions of the Federal Information Security Management Act (FISMA) of 2002. Comments concerning FIPS publications are welcomed and should be addressed to the Director, Information Technology Laboratory, National Institute of Standards and Technology, 100 Bureau Drive, Stop 8900, Gaithersburg, MD 20899-8900. Charles H. Romine, Director Information Technology Laboratory

## Abstract

The  selective  application  of  technological  and  related  procedural  safeguards  is  an  important responsibility of  every federal organization in providing adequate security in its computer and telecommunication  systems. This  standard  is  applicable  to  all  federal  agencies  that  use cryptographic-based  security  systems  to  provide  adequate  information  security  for  all  agency operations and assets as defined in 15 U.S.C. § 278g-3. This standard shall be used in designing and implementing cryptographic modules that federal departments and agencies operate or are operated for them under contract.

Security Requirements for Cryptographic Modules


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice CM.L2-3.4.2 (NIST 3.4.2)?

[Assistant]
According to Managing the Security of Information Exchanges:

3.4.2 Emergency Discontinuance ... 3.4.2 Emergency Discontinuance

If a participating organization detects an attack, intrusion attempt, or other contingency that exploits or jeopardizes the information or systems involved in the information exchange, it might be necessary to abruptly terminate the information exchange without providing written notice to the other party.

Managing the Security of Information Exchanges


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does De-Identifying Government Datasets_ Techniques and Governance provide? (Part 5)

[Assistant]
) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure.
ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities  include the development of management,  administrative,  technical,  and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. The Special Publication 800series  reports  on  ITL's  research,  guidelines,  and  outreach  efforts  in  information  system security, and its collaborative activities with industry, government, and academic organizations. ## Patent Disclosure Notice

NOTICE: ITL has requested that holders of patent claims whose use may be required for compliance  with  the  guidance  or  requirements  of  this  publication  disclose  such  patent claims to ITL. However, holders of patents are not obligated to respond to ITL calls for patents and ITL has not undertaken a patent search in order to identify which, if any, patents may apply to this publication. As of the date of publication and following call(s) for the identification of patent claims whose use may be required for compliance with the guidance or requirements of this publication, no such patent claims have been identified to ITL. No representation is made or implied by ITL that licenses are not required to avoid patent infringement in the use of this publication. ## Table of Contents

| Executive Summary . . . . . . . . . . | Executive Summary . . . . . . . . . . | . . . . . . . . . . .

De-Identifying Government Datasets_ Techniques and Governance


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Planning for a Zero Trust Architecture_ A Planning Guide for Federal Administrators:

Assessing the SP 800-53controls of the system itself should ideally have a continual assessment component utilizing a monitoring program [13].  Frequent automated checks or scans should be conducted to detect changes in the system (as part of the MONITOR step below).  Logging data should be used to detect possible malicious behavior that requires further investigations or remediation. This assessment may also include active processes such as red team testing of the system as input into the assessments.

Planning for a Zero Trust Architecture_ A Planning Guide for Federal Administrators


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Supply Chain Risk Management?

[Assistant]
According to Considerations for Managing Internet of Things (IoT) Cybersecurity and Privacy Risks:

affecting such areas as configuration and patch management. - Differing lifespan expectations. A manufacturer may intend for a particular IoT device to only be used for a few years and then discarded.
An organization purchasing that device might want to use it for a longer time, but the manufacturer may stop supporting the device (e.g., releasing patches for known vulnerabilities) either by choice or because of supply chain limitations (e.g., supplier no longer releases patches for a particular IoT device component). The problem of differing lifespan expectations is not new and is not specific to IoT, but it may be particularly important for some IoT devices because of safety, reliability, and other risks potentially involved in using devices past their intended lifespan. - Unserviceable hardware. IoT device hardware may not be serviceable, meaning it cannot be repaired, customized, or inspected internally. - Lack of inventory capabilities. IoT devices brought into an organization may not be inventoried, registered, and otherwise provisioned via the normal IT processes. This is especially true for types of devices that did not previously have networking capabilities. - Heterogeneous ownership. There is often heterogeneous ownership of IoT devices. For example, an IoT device may transfer data to manufacturer-provided cloud-based service processing and storage. Data may also be sent to a cloud service to aggregate data from multiple IoT devices in a single location. These cloud services may have access to portions or all of the devices' data, or even access to and control of the devices themselves for monitoring, maintenance, and troubleshooting purposes. In some cases, only manufacturers have the authority to do maintenance; an organization attempting to install patches or do other maintenance tasks on an IoT device may void the warranty. Also, in IoT there may be little or no information available about device ownership,

Considerations for Managing Internet of Things (IoT) Cybersecurity and Privacy Risks


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Conformance Assessment of Transport Layer Security Implementations:

- (1) Data Integrity,
- (2) Data Confidentiality,
- (3) Data Origination Authentication, and
- (4) Access Control.

Evaluations of commercial products in the U.S. are carried out through the Department of Defense (DoD) Trusted Product Evaluation Program (TPEP). The TPEP evaluates systems that meet the DoD's program objectives based on the criteria defined in the DoD TCSEC [7]. The TCSEC defines a hierarchy of classes that represent increasing levels of confidence in the trustworthiness of a computer system to protect information. The TCSEC identifies features to be evaluated, such as login, access controls, and audit; and assurances to be obtained, such as least privilege, testing, and documentation. Features are mechanisms that provide security functionality, while assurances indicate the degree of trust, and give a measure of the degree to which features work correctly and are effective.

Conformance Assessment of Transport Layer Security Implementations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Guide to Enterprise Telework, Remote Access, and Bring Your Own Device (BYOD) Security:

The  Information  Technology  Laboratory  (ITL)  at  the  National  Institute  of  Standards  and  Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national securityrelated information in Federal information systems. The Special Publication 800-series reports on ITL's research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations.

All the components of telework and remote access solutions, including client devices, remote access servers, and internal resources accessed through remote access, should be secured against expected threats, as identified through threat models. Major security concerns include the lack of physical security controls, the use of unsecured networks, the connection of infected devices to internal networks, and the availability of internal resources to external hosts.

Organizations should ensure that all types of telework client devices are secured, including PCs, smartphones, and tablets. For PCs, this includes physical security. For devices other than PCs, security capabilities and the appropriate security actions vary widely by device type and specific products, so organizations should provide guidance to device administrators and users who are responsible for securing telework mobile devices on how they should secure them.

Guide to Enterprise Telework, Remote Access, and Bring Your Own Device (BYOD) Security


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Media Protection?

[Assistant]
According to Guide for Security-Focused Configuration Management of Information Systems:

| system owner (or program manager) [SP 800-37] | An organizational official responsible for the procurement, development, integration, modification, operation, maintenance, and disposal of a system.
|
| system security officer [SP 800-37]           | Individual with assigned responsibility for maintaining the appropriate operational security posture for an information system or program. |
| system security plan                          | See information system security plan . |
| system user [SP 800-37]                       | An individual or (system) process acting on behalf of an individual that is authorized to access information and information systems to perform assigned duties. Note: With respect to SecCM, an information system user is an individual who uses the information system functions, initiates change requests, and assists with functional testing. |
| threat [SP 800-30]                            | Any circumstance or event with the potential to adversely impact organizational operations, organizational assets, individuals, other organizations, or the Nation through a system via unauthorized access, destruction, disclosure, modification of information, and/or denial of service. |
| threat source [FIPS 200]                      | The intent and method targeted at the intentional exploitation of a vulnerability or a situation and method that may accidentally trigger a vulnerability. Synonymous with threat agent. |

Guide for Security-Focused Configuration Management of Information Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does Protocol Implementation Conformance Statement (PICS) Proforma for the SDNS Security Protocol at Layer 4 (SP4) provide?

[Assistant]
<!-- image -->

## Protocol Implementation Conformance Statement (PICS) Proforma for the SDNS Security Protocol at Layer 4 (SP4)

Wayne A. Jansen

U.S. DEPARTMENT OF COMMERCE Technology Administration National Institute of Standards and Technology Office of Weights and Measures Gaithersburg, MD 20899

<!-- image -->

QC 100 . U56 49 34

## Protocol Implementation Conformance Statement (PICS) Proforma for the SDNS Security Protocoi at Layer 4 (SP4)

<!-- image -->

Wayne A. Jansen

U.S. DEPARTMENT OF COMMERCE Technology Administration National Institute of Standards and Technology Office of Weights and Measures Gaithersburg, MD 20899

October 1992

<!-- image -->

U.S. DEPARTMENT OF COMMERCE Barbara Hackman Franklin, Secretary

TECHNOLOGY ADMINISTRATION Robert M. White, Under Secretary for Technology

NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY John W. Lyons, Director

## TABLE OF CONTENTS

| 1. | INTRODUCTION                                              | INTRODUCTION                                              |   1 |
|-----------------------------------------------------------|-----------------------------------------------------------|-----------------------------------------------------------|-----|
|                                                           | 1.1                                                       | Background                                                |   1 |
|                                                           | 1.2                                                       | Objectives                                                |   1 |
| 2. | INSTRUCTIONS                                              | INSTRUCTIONS                                              |   2 |
| 3. | IDENTIFICATION                                            | IDENTIFICATION                                            |   3 |
| 4.

Protocol Implementation Conformance Statement (PICS) Proforma for the SDNS Security Protocol at Layer 4 (SP4)

Planning
System and Services Acquisition
Physical Protection
Awareness and Training
Incident Response
Supply Chain Risk Management
Maintenance
System and Communications Protection
Security Assessment
Media Protection
Risk Assessment
Audit and Accountability
Personnel Security
Identification and Authentication
Access Control
System and Information Integrity


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to CMVP Documentation Requirements_ CMVP Validation Authority Updates to ISO_IEC 24759:

CMVP Validation Authority Updates to ISO/IEC 24759

CMVP Validation Authority Updates to ISO/IEC 24759

CMVP Documentation Requirements_ CMVP Validation Authority Updates to ISO_IEC 24759


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Secure Software Development Framework (SSDF) Version 1.1_ Recommendations for Mitigating the Risk of Software Vulnerabilities:

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. The Special Publication 800-series reports on ITL's research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations. - Can be used by organizations in any sector or community, regardless of size or cybersecurity sophistication
- Can be applied to software developed to support information technology (IT), industrial control systems (ICS), cyber-physical systems (CPS), or the Internet of Things (IoT)
- Can be integrated into any existing software development workflow and automated toolchain; should not negatively affect organizations that already have robust secure software development practices in place
- Makes the practices broadly applicable, not specific to particular technologies, platforms, programming languages, SDLC models, development environments, operating environments, tools, etc.

Secure Software Development Framework (SSDF) Version 1.1_ Recommendations for Mitigating the Risk of Software Vulnerabilities


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule_ A Cybersecurity Resource Guide:

.................44                   |
| 5.1.7. Contingency Plan (§ 164.308(a)(7))............................................................................................47             |
| 5.1.8.
Evaluation (§ 164.308(a)(8)).......................................................................................................51        |
| 5.2.1. Facility Access Controls (§ 164.310(a)).......................................................................................56             |
| 5.1.9. Business Associate Contracts and Other Arrangements (§ 164.308(b)(1))................................54                                      |
| 5.2.2. Workstation Use (§ 164.310(b)).................................................................................................59            |
| 5.2.3. Workstation Security (§ 164.310(c)) ..........................................................................................61             |

Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule_ A Cybersecurity Resource Guide


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Recommended Cybersecurity Requirements for Consumer-Grade Router Products:

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leade rship for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. - Machine-readable asset identification support. Consumer-grade routers serve as a central connection point for networks. Many types of devices will gain access to the local network and usually the internet. Consumer grade routers can be more proactive in managing the cybersecurity of the network when machine-readable asset identifiers are available. While home users could utilize machine-readable asset identification, it is more likely to be useful to small businesses or for routers leased from internet service providers (ISPs). Identification can also go beyond simple inventorying to include device type and firmware version, be extended by concepts like device intent signaling (e.g., the ' manufacturer usage description ' [MUD]) or be used more directly for the management of router devices ' firmware updates. Machine-readable asset identifiers must be developed and used in ways that are privacy preserving. - Interface and functionality minimization for consumer-grade router devices. ' Secureby-design ' principles [SecureByDesign] applied to consumer-grade routers should guide manufacturers to minimize the number of interfaces, both logical and physical and general functionality provided by the router device.

Recommended Cybersecurity Requirements for Consumer-Grade Router Products


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Personnel Security?

[Assistant]
According to Minimum Security Requirements for Federal Information and Information Systems:

1 An information system is a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information.  Information resources include information and related resources, such as personnel, equipment, funds, and information technology.

The minimum security requirements cover seventeen security-related areas with regard to protecting the confidentiality, integrity, and availability of federal information systems and the information processed, stored, and transmitted by those systems.  The security-related areas include: (i) access control; (ii) awareness and training; (iii) audit and accountability; (iv) certification, accreditation, and security assessments; (v) configuration management; (vi) contingency planning; (vii) identification and authentication; (viii) incident response; (ix) maintenance; (x) media protection; (xi) physical and environmental protection; (xii) planning; (xiii) personnel security; (xiv) risk assessment; (xv) systems and services acquisition; (xvi) system and communications protection; and (xvii) system and information integrity.  The seventeen areas represent a broad-based, balanced information security program that addresses the management, operational, and technical aspects of protecting federal information and information systems.

Awareness and Training (AT): Organizations must: (i) ensure that managers and users of organizational information systems are made aware of the security risks associated with their activities and of the applicable laws, Executive Orders, directives, policies, standards, instructions, regulations, or procedures related to the security of organizational information systems; and (ii) ensure that organizational personnel are adequately trained to carry out their assigned information security-related duties and responsibilities.

Minimum Security Requirements for Federal Information and Information Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to 3rd High-Performance Computing Security Workshop_ Joint NIST-NSF Workshop Report:

There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST. The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems.

3rd High-Performance Computing Security Workshop_ Joint NIST-NSF Workshop Report


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Incident Response Recommendations and Considerations for Cybersecurity Risk Management_ A CSF 2.0 Community Profile:

- Employing a botnet to send high volumes of connection requests to an internet-facing service, making it unavailable to legitimate service users
- Obtaining administrative credentials at a software-as-a-service provider, which puts sensitive tenant data entrusted to that provider at risk
- Intruding upon an organization's business network to steal credentials and use them to instruct industrial control systems to shut down or destroy critical physical components, causing a major service disruption
- Deploying ransomware to prevent the use of computer systems and cause multiple data breaches by copying files from those systems
- Using phishing emails to compromise user accounts and using those accounts to commit financial fraud
- Identifying a new vulnerability in network management appliances and exploiting the vulnerability to gain unauthorized access to network communications
- Compromising a vendor's software, which is subsequently distributed to customers in its compromised state

Processes and procedures should be based on the incident response policy and plan. Documented procedures should explain how technical processes and other operating procedures should be performed. Procedures can be tested or exercised periodically to verify their accuracy and can be used to help train new personnel. While it is impossible to have detailed procedures for every possible situation, organizations should consider documenting procedures for responding to the most common types of incidents and threats. Organizations should also develop and maintain procedures for particularly important processes that may be urgently needed during emergency situations, such as redeploying the organization's primary authentication platform.

Incident Response Recommendations and Considerations for Cybersecurity Risk Management_ A CSF 2.0 Community Profile


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Minimum Security Requirements for Multi-User Operating Systems:

| SECTION   | SECTION      | SECTION                                                     | PAGE   |
|-----------|--------------|-------------------------------------------------------------|--------|
|           | Abstract     |                                                             | ii     |
| 1. | Introduction | Introduction                                                | 1-1    |
|           | 1.1          | Background                                                  | 1-1    |
|           |              | 1.1.1 Trusted Computer System ^valuation Criteria (TCSEC)   | 1-2    |
|           | 1.1.2        | Information Technology Security Evaluation Criteria (TTSEC) | 1-2    |
|           |              | 1.1.3 Security Requirements in the Commercial Sector        | 1-3    |
|           |              | 1.1.4 System Security Study Committee                       | 1-4    |
|           |              | 1.1.5 Federal Criteria Project                              | 1-5    |
|           |              | 1.1.6 Minimum Security Requirements                         | 1-5    |
|           | 1.2          | Scope of the MSR                                            | 1-6    |
|           | 1.3          | Audience                                                    | 1-6    |
|           | 1.4          | Terminology                                                 | 1-7    |
|           | 1.5          | Document Organization                                       | 1-7    |
| 2.

Minimum Security Requirements for Multi-User Operating Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Supplemental Information for the Interagency Report on Strategic U.S. Government Engagement in International Standardization to Achieve U.S. Objective provide? (Part 5)

[Assistant]
| Standards Developing Organizations (SDOs) ...........................................................................
21                                 |
| 7                                                                                | IT Standards Development .......................................................................................................30                       |
| 8                                                                                | Accelerating IT Standards Development .................................................................................. 34                              |
| 9                                                                                | Ongoing Issues in IT Standards Development .......................................................................... 36                                 |
| 10                                                                                | How to Effectively Engage SDOs .......................................................................................... 38                             |
| Annex A - Terms and Definitions .................................................................................................... 41                  | Annex A - Terms and Definitions .................................................................................................... 41                  |
| Annex B - Conformity Assessment ...................................................................................................

Supplemental Information for the Interagency Report on Strategic U.S. Government Engagement in International Standardization to Achieve U.S. Objective


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Assessing Security and Privacy Controls in Information Systems and Organizations:

NTROL ASSESSMENTS ..................................................... 30
3.4   ANALYZE ASSESSMENT REPORT RESULTS .....................................................................................
32
3.5   ASSESS SECURITY AND PRIVACY CAPABILITIES .............................................................................. 34
CHAPTER FOUR SECURITY AND PRIVACY ASSESSMENT PROCEDURES ................................................. 37
4.1   ACCESS CONTROL............................................................................................................................ 40
4.2   AWARENESS AND TRAINING ........................................................................................................ 118
4.3   AUDIT AND ACCOUNTABILITY ...................................................................................................... 128
4.4   ASSESSMENT, AUTHORIZATION, AND MONITORING ................................................................. 160
4.5   CONFIGURATION MANAGEMENT ................................................................................................ 177
4.6   CONTINGENCY PLANNING ............................................................................................................ 215
4.7   IDENTIFICATION AND AUTHENTICATION .................................................................................... 243
4.8   INCIDENT RESPONSE ............................................................................................................... 275
4.9   MAINTENANCE ........................................................................................................................ 298
4.10   MEDIA PROTECTION .............................................................................................................. 316
4.11   PHYSICAL AND ENVIRONMENTAL PROTECTION .......................................................................

Assessing Security and Privacy Controls in Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Personnel Security?

[Assistant]
According to Computer Security Division 2004 Annual Report:

ity  CERT Coordination  Center, the  American  Bankers Association, Ars Technica and EDUCAUSE. This area  added  twelve  practices  in  the  past  year bringing the total number of listings to twenty.
The Defense Information Systems Agency (DISA) issues STIGs and checklists for a variety of information technologies and hosts these on its Web site. Many of these resources deal with classified system requirements, and hence access is restricted  to  military  and  government  personnel only. Some  of  these  resources, however, are suitable  for  non-classified  system  use. CSD, through an agreement with DISA, houses a repository of the STIGs and checklists that are suitable for  non-classified  systems  so  they  may  be accessed by contractors that handle Federal information systems. These guides and checklists are also available for voluntary adoption by others.

Computer Security Division 2004 Annual Report


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AU.L2-3.3.1 (NIST 3.3.1)?

[Assistant]
According to Measurement Guide for Information Security_ Volume 1 — Identifying and Selecting Measures:

3.3.1. 3.3.1.

Measurement Guide for Information Security_ Volume 1 — Identifying and Selecting Measures


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Computer Security Division 2013 Annual Report:

ivacy technologies, including privacy framework, privacy reference architecture, privacy infrastructure, anonymity and credentials, and specific privacyenhancing technologies

Guidelines  (VVSG)  1.1.
The  security  guidelines  were  updated in  FY  2012  to  improve  the  auditability  of  voting  systems,  to provide  greater  software  integrity  protections,  to  expand  and improve  access  control  requirements,  and  to  help  ensure cryptographic security mechanisms are implemented properly. In addition, CSD supported the efforts of the EAC and Federal Voting Assistance Program (FVAP) of DoD to improve the voting process for citizens under the Uniformed and Overseas Citizens Voting Act (UOCAVA) by leveraging electronic technologies. The team worked with the TDCG's UOCAVA Working Group to develop a risk analysis on technologies used in current UOCAVA voting processes,  including  vote-by-mail,  online  voter  registration, electronic ballot delivery, and online ballot marking.

Computer Security Division 2013 Annual Report


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AU.L2-3.3.3 (NIST 3.3.3)?

[Assistant]
According to Derived PIV Application and Data Model Test Guidelines:

3.3.3 Mutual Authenticate with Derived PIV Token Management Key

| Test Assertion   | TA-08. 3.3.3 Public Key Size

| Test Assertion       | TA-09.

Derived PIV Application and Data Model Test Guidelines


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to Introduction to Cybersecurity for Commercial Satellite Operations:

| Informative SP 800-53, Rev. 4                      | Reference SP 800-53, Rev.
5                      |
|-------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------|--------------------------------------------------|
|             | ID.SC-4: Suppliers and third- party partners are routinely assessed using audits, test results, or other forms of evaluation to confirm that they are meeting their contractual obligations. | AU-6, PS-7, SA- 9                                  | AU-6, CA-2, CA-7, PS-7, SA-9, SA-11              |
| Protect     | PR.AC-1: Identities and credentials are issued, managed, verified, revoked, and audited for authorized devices, users, and processes. | IA-8                                               | IA-8                                             |
|             | PR.AC-3: Remote access is managed. | AC-1, AC-19, SC-15                                 | AC-1, AC-19, SC-15                               |
|             | PR.AC-4: Access permissions and authorizations are managed to incorporate the principles of least privilege and separation of duties. | AC-1, AC-2, AC- 3, AC-5, AC-6, AC-16, AC-24        | AC-1, AC-2, AC-3, AC-5, AC-6, AC-16, AC-24       |
|             | PR.AC-6: Identities are proofed and bound to credentials and asserted in interactions. | AC-16, IA-1, IA- 2, IA-4, IA-5, IA- 12, PE-2, PS-3 | AC-16, IA-1, IA-2, IA-4, IA-5, IA-12, PE-2, PS-3 |
|             | PR.AC-7: Users, devices, and other assets are authenticated (e.g., single-factor, multi-factor) commensurate with the risk of the transaction (e.g., individuals' security and privacy risks and other organizational risks).

Introduction to Cybersecurity for Commercial Satellite Operations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Computer Security Division 2015 Annual Report provide? (Part 3)

[Assistant]
ues  in  the  Computer  Security  Division, who  provided write-ups on their 2015 project highlights and accomplishments for this annual report (their names are mentioned after each project write-up).
The editor would also like to acknowledge Elaine  Barker  (CSD),  Lisa  Carnahan  (Standards  Coordination  Office, NIST), Greg Witte and Larry Feldman (G2) for reviewing and providing valuable feedback for this annual report. The  editor  would  also  like  to  acknowledge  Kristen  Dill  of  Dill and Company, Inc. for designing the cover and inside layout for this 2015 annual report. ## DI S C L A I M E R

Any  mention  of  commercial  products  or  organizations  is  for informational  purposes  only;  it  is  not  intended  to  imply  recommendation or endorsement by the National Institute of Standards and Technology, nor is it intended to imply that the products identified are necessarily the best available for the purpose. ## T R A D E M A R K   I N F O R M AT I O N

All names are trademarks or registered trademarks of their respective owners.

Computer Security Division 2015 Annual Report


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Personnel Security?

[Assistant]
According to PIV Card Application and Middleware Interface Test Guidelines (SP 800-73-4 Compliance):

+ Installation and Execution instructions (for PIV Middleware): The vendor provides technical instructions and other documentation to aid the testing personnel in installing and using the PIV Middleware implementation under test. The PIV Middleware implementation could be in any high-level programming language. Since all the implementations have to be tested from a common test program, the PIV Middleware vendor submitting the product for testing may have to provide Java wrapper programs in some cases to the test facility. The purpose of the wrapper program is to translate the test execution calls made using the test program to the PIV Middleware implementation's native program calls.
+ Technical documentation (for both PIV Card Application and PIV Middleware): The vendor-supplied technical documentation must include the detailed technical description and the design of the implementation to be tested. This document includes, at a minimum, all the required vendor information specified in DTRs in Appendix A of this document.
+ Security-related information: The following security related information shall be provided by the vendor: (a) PIV Card Application PIN, (b) PIN Unblocking Key (PUK), (c) Global PIN, (d) pairing code, (e) cryptographic algorithms supported by the card, (f) minutia data, and (g) the number of unsuccessful attempts using (1) wrong PIV Card Application PIN, (2) wrong Global PIN, (3) wrong PUK, (4) and wrong minutia data.

response is sent to the vendor. Vendors who object to the results presented in the discrepancy report must explain their reason for the objection. If the reason necessitates another retest, the test laboratory may consider repeating the test. Otherwise, the test lab will seek the guidance of the NIST personnel on the failure before the component is returned to the vendor to be corrected.

PIV Card Application and Middleware Interface Test Guidelines (SP 800-73-4 Compliance)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Case Studies in Cyber Supply Chain Risk Management_ Palo Alto Networks, Inc.:

Palo Alto Networks ensures consistent quality management and product security with a wide range of handling policies. All materials related to the production of Palo Alto Networks products must be stored in facilities with strict access controls and 24/7 physical and electronic monitoring. The CM is required to perform complete background, reference, and employment history checks for every candidate before they may access and work on Palo Alto Networks products. CM ICT networks are designed around well-established security standards, including the NIST CSF and ISO/IEC 27001 ix . The CM features a dedicated cybersecurity team and is required to perform regular third-party assessments, including penetration testing and vulnerability assessments. Palo Alto Networks' products are not built or packaged for any particular customer. Rather, the CM prepares prepackaged inventory to satisfy sales forecasts and prevent would-be attackers from targeting specific customers during the production phase.

Case Studies in Cyber Supply Chain Risk Management_ Palo Alto Networks, Inc.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Best Practices for Privileged User PIV Authentication provide? (Part 5)

[Assistant]
Impersonation is usually accomplished by exploiting known weaknesses of password-based single-factor authentication. To greatly reduce the risk of privileged user impersonation to non-national security federal systems, the Cybersecurity Strategy and Implementation Plan (CSIP) [1] published by the Office of Management and Budget (OMB) directs agencies to transition to multi-factor 1 Personal Identity Verification (PIV)-based authentication for all privileged users. This white paper provides additional information regarding this requirement from the CSIP. The purpose of the white paper is to explain the requirement's importance from a security standpoint and to provide best practices for adopting a solution that meets the requirement. ## 1.1 Limitations of Password-Based Single-Factor Authentication

For many years, most organizations, including federal agencies, have relied heavily on password-based single-factor user authentication. There are many types of threats against this form of authentication, including the following:

- Capturing passwords: an attacker acquiring a password from storage, transmission, or user knowledge and behavior. Examples of ways that attackers capture passwords include the following:
- o Infecting a system with malware that acts as a keylogger, 2 capturing the user's keystrokes;
- o Conducting social engineering to trick a user into revealing a password via phishing emails and fraudulent imitation websites, social networks, phone calls, etc.;
- o Gaining logical or physical access to a system and recovering stored passwords that are unencrypted or weakly encrypted;
- o Monitoring network traffic and recovering passwords or password hashes that are not adequately protected (e.g., unencrypted, weakly encrypted, replayable);
- o Watching a user type a password (i.e., shoulder surfing); and
- o Finding passwords that have been written down on paper, workstations, white boards, etc.

Best Practices for Privileged User PIV Authentication


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Report on the Block Cipher Modes of Operation in the NIST SP 800-38 Series:

ryptographic literature, where the security requirement for confidentiality assumes that the adversary knows and can even choose (parts of) the plaintext and observe the corresponding ciphertext [14].
For an example of a practical attack where the adversary has this power, see the BEAST (Browser Exploit Against SSL/TLS) attack on the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, known in the NVD as CVE-2011-3389 [62]. The OFB and CTR modes in NIST SP 800-38A are not intended to provide any notion of integrity, meaning that they are not secure against adversaries who can modify the ciphertexts. For example, the OFB and CTR modes process every bit of the plaintext separately, so an adversary can make arbitrary changes to bits in the plaintext by flipping the corresponding bits in the ciphertext. This property is explained in Appendix D of NIST SP 800-38A. The same 'bit flipping attack' also applies to the IV of the CBC mode. Indeed, Appendix D of NIST SP 800-38A clarifies that the integrity of the IV used for the CBC mode needs to be protected for this reason. Historically, it was assumed that the CBC and CFB modes do provide some notion of integrity because bit errors in the ciphertext will lead to random errors in at least one block of the plaintext. 3 However, the statement in Appendix D of NIST SP 800-38A that 'the existence of such bit errors may be detected by their randomizing effect on the decryption of the succeeding ciphertext segment' can be misunderstood. More specifically, some integrity protection mechanism against random errors in the plaintext was thought to be sufficient, such as introducing a cyclic redundancy check (CRC) to the plaintext. This is not the case, however, as shown by an attack on the CBC and CFB modes as used in version 1.5 of the Secure Shell (SSH) protocol [37], known as CVE-1999-1085 [59].

Report on the Block Cipher Modes of Operation in the NIST SP 800-38 Series


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to The NIST Cybersecurity Framework (CSF) 2.0:

- o ID.RA-02: Cyber threat intelligence is received from information sharing forums and sources - o ID.RA-03: Internal and external threats to the organization are identified and recorded - o ID.RA-04: Potential impacts and likelihoods of threats exploiting vulnerabilities are identified and recorded - o ID.RA-05: Threats, vulnerabilities, likelihoods, and impacts are used to understand inherent risk and inform risk response prioritization - o ID.RA-06: Risk responses are chosen, prioritized, planned, tracked, and communicated - o ID.RA-07: Changes and exceptions are managed, assessed for risk impact, recorded, and tracked - o ID.RA-08: Processes for receiving, analyzing, and responding to vulnerability disclosures are established - o ID.RA-09: The authenticity and integrity of hardware and software are assessed prior to acquisition and use - o ID.RA-10: Critical suppliers are assessed prior to acquisition - Improvement (ID.IM): Improvements to organizational cybersecurity risk management processes, procedures and activities are identified across all CSF Functions - o ID.IM-01: Improvements are identified from evaluations - o ID.IM-02: Improvements are identified from security tests and exercises, including those done in coordination with suppliers and relevant third parties - o ID.IM-03: Improvements are identified from execution of operational processes, procedures, and activities - o ID.IM-04: Incident response plans

The NIST Cybersecurity Framework (CSF) 2.0


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Security Guidelines for Storage Infrastructure:

and network technologies, storage technology has also evolved over the years. Higher capacity storage media and storage system architecture are the two fronts on which storage technology has evolved.
The developments on the second front have enabled storage services to support many new and evolving computing use cases but have also introduced storage management complexity and many security challenges.

Security Guidelines for Storage Infrastructure